Contractor Business Systems: DOD Needs Better Information to Monitor and Assess Review Process

GAO-19-212 Published: Feb 07, 2019. Publicly Released: Feb 07, 2019.
Jump To:
Fast Facts

The Department of Defense uses data from contractors' business systems—e.g., accounting or purchasing systems—to guard against fraud, waste, and abuse in DOD contracts. For example, reviewing data from a contractor's accounting system can help keep the contractor from overcharging.

DOD must review contractors' business systems to ensure that the data from them can be used. We've previously found that it was years behind on some of these reviews.

DOD has an ambitious plan to catch up on these reviews in 3 years, but has no way to measure its progress. We recommended that DOD monitor and assess whether it's completing these reviews as planned.


A person with a magnifying glass and a calculator views data on a spreadsheet.

A person with a magnifying glass and a calculator views data on a spreadsheet.

Skip to Highlights

What GAO Found

Since 2011, the Department of Defense (DOD) has implemented several changes to its processes for reviewing contractor business systems—which include systems such as accounting, estimating, and purchasing. Among other changes, DOD

clarified the roles and responsibilities of the Defense Contract Management Agency (DCMA) and the Defense Contract Audit Agency (DCAA)—the two agencies that are responsible for conducting the reviews;

clarified timeframes for business system reviews and established criteria for business systems; and

withheld payments from contractors that were found to have significant deficiencies in their business systems.

DOD does not have a mechanism to monitor and ensure that these reviews are being conducted in a timely manner. For its part, DCAA has conducted few business system audits since 2013, as it focused its efforts on other types of audits. DCAA plans to significantly increase the number of business system audits over the next 4 years, but its success in doing so depends on its ability to shift resources from other audits; to use public accounting firms to conduct other, non-business system audits; and DCAA staff's ability to execute new audit plans in a timely manner.


U:\Work in Process\Teams\FY19 Reports\CNSA\102329_212\Graphics\HL_5_v2-102329-rmw.tif

DCMA relies on the three offices responsible for conducting DCMA-led reviews to manage the reviews, but DCMA does not formally monitor whether these reviews are being conducted consistent with policy nor does it monitor DCAA's efforts to complete the audits for which it is responsible. DCMA is ultimately responsible for approving a contractor's business systems. DCMA currently lacks a mechanism based on relevant and reliable information, such as the number of reviews that are outstanding and the resources available to conduct such reviews, to ensure reviews are being completed in a timely fashion. Such information could help inform more strategic oversight on whether the current review process is achieving its intended results, or whether additional changes to the timing of or criteria for conducting reviews are needed.

Why GAO Did This Study

Contractor business systems produce critical data that contracting officers use to help negotiate and manage defense contracts. These systems and their related internal controls act as important safeguards against fraud, waste, and abuse of federal funding. Federal and defense acquisition regulations and DOD policies require that DOD take steps to review the adequacy of certain business systems, but GAO and other oversight entities have raised questions about the sufficiency and consistency of DOD's review process.

The National Defense Authorization Act for Fiscal Year 2018 contained a provision for GAO to evaluate how DOD implemented legislation intended to improve its business system review process. Among other things, this report examines (1) the changes DOD made to its review process and (2) the extent to which DOD is ensuring timely business system reviews.

GAO analyzed DOD acquisition regulations, policies, and procedures for conducting contractor business system reviews and analyzed data on reviews conducted between fiscal years 2013 and 2018.

Skip to Recommendations


GAO recommends that DCMA, in collaboration with DCAA, develop a mechanism to monitor and ensure contractor business system reviews are conducted in a timely fashion. DOD concurred with the recommendation.

Recommendations for Executive Action

Agency Affected Recommendation Status
Defense Contract Management Agency We recommend that the Director, DCMA, in collaboration with the Director, DCAA, develop a mechanism to monitor and assess whether contractor business systems reviews are being completed in a timely manner. (Recommendation 1)
Open – Partially Addressed
DCMA concurred with our recommendation and the department notified us in March 2019 that collaboration between DCMA and DCAA to develop a mechanism to increase oversight and improve management of contractor business system audits and determinations had begun. In September 2019, DCMA and DCAA provided lists of the business system reviews planned to be conducted during fiscal year 2020, showing that the data needed for oversight of all CBS reviews is available between the two agencies. Further, an April 2019 DCMA memorandum indicated that DCAA data on planned reviews for fiscal years 2019 and 2020 had been transferred to DCMA and that administrate contracting officers were to conduct risk assessments to identify additional reviews for DCAA to complete in the future. In August 2020, DCMA and DCAA specified the sources of the data provided earlier; DCAA data is collected through its strategic workload and resource initiative and inputted into the DCAA Management Information System while DCMA business system review data continues to be maintained by the functional offices responsible for those reviews. Both agencies stated that progress against planned reviews is tracked and status is reported to management at regular intervals. DCMA also noted a series of new tools designed to enhance surveillance of contractor business systems and implementation of corrective actions. In March 2021, senior DCAA officials noted that the frequency and quality of communication on CBS reviews between the two agencies has increased. In May 2022, DCMA issued guidance for its contracting officers and functional specialists on how to ensure the status of business systems is correctly inputted into the Contract Business Analysis Repository, the primary tools used by DMCA for monitoring CBS reviews. Further, in September 2022, DCAA reported that it provides monthly, Contract Audit Follow Up reports to DCMA that, among other things, provide the status of CBS reviews. These steps indicate progress towards increased insight into both the completion CBS reviews and the follow-up that occurs afterward. We will continue to work with DCAA and DCMA to understand the content of reporting and how it results are recorded in applicable data systems used to track review completion.

Full Report

GAO Contacts